CMMC Phase 2 status: suspended pending review. On July 13, 2026 the Department of War paused the CMMC rollout and suspended Phase 2 pending a 60 day review. CMMC Level 1 and Level 2 self-assessments, SPRS, the annual affirmation, NIST SP 800-171 and DFARS 252.204-7012 still stand.
Update, 2026-08-21: CMMC Phase 2 was suspended by the Department of War on July 13, 2026, and the November 10, 2026 effective date discussed below is no longer in force. See our current CMMC Phase 2 status for what still applies.
Phase 2 was set to take effect on November 10, 2026, when DoD contracts would have begun requiring verified CMMC Level 2 certification as a condition of award. On July 13, 2026 the Department of War suspended Phase 2 pending a 60 day review. For the estimated 80,000 small and mid-size companies in the Defense Industrial Base, the underlying obligations stand: DFARS 252.204-7012, NIST SP 800-171, Level 2 self-assessments and SPRS.
As of early 2026, fewer than 1,000 defense contractors have secured final CMMC certification. That leaves tens of thousands of companies staring down a window to achieve something that typically takes 12 to 18 months to complete properly.
Have questions about this topic?
Book a call with us and get your questions answered directly.
What Was Set to Happen on November 10, 2026?
CMMC Phase 2 activates. DoD solicitations may begin requiring CMMC Level 2 certification by a C3PAO as a condition of contract award. Companies without a current CMMC status at the required level may be ineligible to bid on or receive certain DoD contracts. See the DoD CMMC Phase 2 rule for official details.
Why the Timeline Is Tighter Than You Think
Before the suspension, C3PAOs were reporting 6-month backlogs for formal assessments, and that backlog will matter again when Phase 2 resumes.
The typical path to CMMC Level 2 certification:
- Gap Assessment: 2 to 4 weeks to identify which of the 110 controls you meet and which have gaps.
- Remediation: 3 to 9 months depending on severity of gaps.
- SSP and documentation: 4 to 8 weeks to prepare required evidence.
- C3PAO assessment scheduling and completion: 2 to 6 months.
Add it up: a 12 to 18 month process, which is why starting now still matters while Phase 2 is under review.
What Should You Do Right Now?
Step 1: Complete a Gap Assessment Immediately
Before you can fix anything, you need to know what is broken. A CMMC gap assessment maps your current posture against the 110 required controls and gives you a prioritized list of your compliance gaps by severity. Cyber Grants Alliance provides it in-kind, at no cost to you.
Get an In-Kind Gap Assessment
CGA’s CMMC Gap Assessment Grant provides an in-kind assessment for qualifying DIB manufacturers. Apply now; grants are awarded first come, first served.
Step 2: Review Your Contracts for CUI Requirements
Check your contracts for DFARS clause 252.204-7012. If it is there, you handle CUI and Level 2 applies. If you are unsure whether you need Level 1 or Level 2, see our guide on CMMC Level 1 vs Level 2. Contact your prime contractor if you are unsure; they are required to flow down CMMC requirements.
Step 3: Book a C3PAO Assessment Slot Now
Even before remediation is complete, reach out to C3PAOs and get on their schedule. Backlogs are real and growing. You can reschedule a slot. You cannot manufacture time you have already lost.
Step 4: Apply for an Available Grant
Remediation has real costs. Cyber Grants Alliance and regional MEP centers offer programs for gap assessments, employee training, and cybersecurity certifications. Explore all available CGA grant programs before you spend out of pocket.
What Happens If You Miss the Deadline?
Companies without the required CMMC status will be ineligible for contract awards that require certification. Unlike many compliance frameworks, CMMC does not offer a grace period. Every one of the 110 Level 2 controls must be fully implemented and evidenced.
The companies that wait until late 2026 will face three problems at once: assessor backlogs, rushed remediation, and higher costs for compressed timelines. Start now.